Data Processing Agreement

1. Definitions

• "Controller" means the entity that determines the purposes and means of the processing of Personal Data (you, the Customer)
• "Processor" means the entity that processes Personal Data on behalf of the Controller (Drengskapur LLC)
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion
• "Data Subject" means the individual to whom Personal Data relates
• "Subprocessor" means any third party engaged by the Processor to process Personal Data
• "Data Protection Laws" means the GDPR, UK GDPR, and any other applicable data protection legislation

2. Scope and Purpose

2.1 Subject Matter

This DPA applies to the processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of LawForge services as described in the Terms of Service.

2.2 Nature and Purpose of Processing

2.3 Categories of Data Subjects

• Customer's employees and contractors using the Service
• Customer's end users (if applicable)

2.4 Types of Personal Data

• Account information (name, email address)
• Authentication data (OAuth tokens, session identifiers)
• Usage data (API requests, search queries)
• Technical data (IP addresses, device identifiers)

3. Processor Obligations

The Processor shall:

3.1 Processing Instructions

• Process Personal Data only on documented instructions from the Controller, unless required by applicable law
• Immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws

3.2 Confidentiality

• Ensure that persons authorized to process Personal Data have committed to confidentiality obligations
• Limit access to Personal Data to personnel who need access for service provision

3.3 Security Measures

Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit (TLS 1.3) and at rest (AES-256)
• Measures to ensure ongoing confidentiality, integrity, and availability
• Regular testing and evaluation of security measures
• Procedures for handling security incidents

3.4 Subprocessing

• Not engage another processor without prior specific or general written authorization of the Controller
• Where general authorization is given, inform the Controller of any intended changes and provide an opportunity to object
• Ensure subprocessor contracts impose equivalent data protection obligations

3.5 Data Subject Rights

• Assist the Controller in responding to requests from Data Subjects exercising their rights under Data Protection Laws
• Notify the Controller promptly upon receiving any Data Subject request

3.6 Data Breach Notification

• Notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach
• Provide sufficient information to enable the Controller to meet its breach notification obligations

3.7 Audit Rights

• Make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR
• Allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice

4. International Data Transfers

4.1 Transfer Mechanisms

Personal Data may be transferred to and processed in the United States and other countries. Following the Court of Justice of the European Union's decision in Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems (C-311/18, "Schrems II"), we rely on the following mechanisms for lawful international transfers:

• EU-US Data Privacy Framework: Where applicable, for transfers to DPF-certified organizations
• Standard Contractual Clauses (SCCs): EU Commission-approved clauses (2021/914) for data transfers from the EEA
• UK International Data Transfer Agreement (IDTA): For transfers from the United Kingdom
• Supplementary Measures: Technical measures including encryption in transit (TLS 1.3) and at rest (AES-256) as required by Schrems II

4.2 Transfer Impact Assessments

In accordance with EDPB recommendations following Schrems II, we conduct Transfer Impact Assessments (TIAs) to evaluate the legal framework of recipient countries. Upon request, we will provide relevant TIA documentation to Controllers.

4.3 Standard Contractual Clauses

For transfers of Personal Data from the EEA to countries not recognized as providing adequate protection, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module Two: Controller to Processor) are incorporated by reference and form part of this DPA.

4.4 UK Addendum

For transfers of Personal Data from the United Kingdom, the UK IDTA Addendum to the EU SCCs applies, and is incorporated by reference.

4.5 Adequacy Invalidation

In the event that any adequacy decision or transfer mechanism relied upon is invalidated by a court or regulatory authority (as occurred with Privacy Shield in Schrems II), we will promptly implement alternative lawful transfer mechanisms or, if no lawful mechanism is available, work with the Controller to minimize or cease transfers as required.

5. Subprocessors

The Controller grants the Processor general authorization to engage the following Subprocessors. Consistent with German court decisions (Regional Court of Lübeck, 15 O 216/23; Higher Regional Court of Dresden, 4 U 940/24), we maintain written agreements with all Subprocessors imposing equivalent data protection obligations:

6. Data Retention and Deletion

6.1 During the Agreement

The Processor will retain Personal Data only for as long as necessary to provide the Service and fulfill the purposes outlined in this DPA.

6.2 Upon Termination

Upon termination of the service agreement or upon the Controller's request, the Processor shall, at the Controller's choice:

• Return all Personal Data to the Controller in a commonly used, machine-readable format
• Delete all Personal Data, unless retention is required by applicable law

Deletion will be completed within 30 days of the termination or request, unless otherwise agreed or required by law.

7. Technical and Organizational Measures

The Processor implements the following security measures (Annex II per the SCCs):

8. Liability

Each party's liability under this DPA is subject to the limitations of liability set forth in the Terms of Service, except that such limitations shall not apply to liability arising from:

• Either party's breach of its obligations under Section 3 (Processor Obligations)
• The Processor's processing of Personal Data outside the scope of the Controller's instructions
• Regulatory fines imposed directly on a party for its own violations

9. General Provisions

9.1 Governing Law

This DPA shall be governed by the laws of the State of Wyoming, without regard to conflict of law principles, except that Data Protection Laws of the applicable jurisdiction shall apply to the extent they are more protective.

9.2 Conflict

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of Personal Data.

9.3 Modifications

This DPA may be modified to ensure continued compliance with Data Protection Laws. We will provide notice of material changes and your continued use of the Service constitutes acceptance of the updated DPA.

10. Contact

For questions about this DPA or to request a signed copy:

For data protection inquiries and Data Subject requests: privacy@lawforge.io